Bug 1033121 - Release |mTimer| in nsTimerEvent::Run() instead of ~nsTimerEvent() to avoid race. r=bz

xpcom/threads/nsTimerImpl.cpp

@@ -709,6 +709,11 @@ nsTimerEvent::Run()
 #endif
 
   mTimer->Fire();
+  // Since nsTimerImpl is not thread-safe, we should release |mTimer|
+  // here in the target thread to avoid race condition. Otherwise,
+  // ~nsTimerEvent() which calls nsTimerImpl::Release() could run in the
+  // timer thread and result in race condition.
+  mTimer = nullptr;
 
   return NS_OK;
 }